EUVD-2026-29683
GHSA-wv8v-gjw3-v3xp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated low-priv access with no user interaction escalates to SYSTEM, giving full confidentiality, integrity, and availability impact within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Server Data Deduplication feature (dedup.sys / associated services) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level rights. Reported by Microsoft across Windows Server 2012 R2 through 2025, it carries a CVSS 7.8 and total technical impact per CISA SSVC, but has no public exploit identified at time of analysis and a very low EPSS of 0.04% (13th percentile). It is not listed in CISA KEV and shows no evidence of active exploitation.
Technical ContextAI
The flaw is a use-after-free (CWE-416) in Windows Data Deduplication, an optional server role service that reduces disk usage by storing single copies of redundant file chunks. Deduplication operates through kernel-mode filter components and background optimization jobs that manage chunk-store metadata objects; a use-after-free occurs when a freed object is referenced again, letting an attacker who controls the reallocated memory manipulate kernel execution flow. The CPE data confirms the affected surface is the Windows Server operating system family (2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025, including Server Core installations), where the Data Deduplication role is available but not enabled by default.
RemediationAI
Apply the Microsoft security update for your Windows Server release via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41095; patch available per vendor advisory, with fixed builds of 6.3.9600.23181 (2012 R2), 10.0.14393.9140 (2016), 10.0.17763.8755 (2019), 10.0.20348.5139 (2022), 10.0.25398.2330 (2022 23H2), and 10.0.26100.32860 (2025). Where patching must be deferred, the most direct compensating control is to disable or uninstall the Data Deduplication role on servers that do not require it (Remove-WindowsFeature FS-Data-Deduplication), which removes the vulnerable code path but reverses storage savings and requires re-hydration considerations for already-deduplicated volumes. Additionally restrict interactive and service logon rights on affected servers to trusted administrators to limit which low-privileged local accounts could stage the attack.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today